Resources

Resources

The frameworks, agencies and tools I actually point clients to. No gated PDFs, no email wall — if it's useful, it's here.

If something is happening right now

Stop and read this first. If you think you're in an active incident, don't investigate on your own — you can destroy the evidence you'll need. Call me at (520) 257-2667 or text (520) 488-0034.

FBI Internet Crime Complaint Center (IC3)Where you file a federal complaint on cyber fraud, BEC and ransomware. Do this early; it matters for insurance and recovery.FBI Field OfficesFind your local office. For a serious incident, call them, don't just file online.FBI Guidance for Cyber Incident Victims on SEC Reporting CISA Report an Incident Report a Cyber Attack (Incognito CyberSecurity)

Frameworks

Frameworks worth knowing

NIST Cybersecurity Framework (CSF) 2.0The one I build most small-business security programs around. Six functions: Govern, Identify, Protect, Detect, Respond, Recover. Start here.

NIST SP 800-53 Rev. 5The full control catalog. Heavy. You need this if you're touching federal work.

NIST Risk Management Framework (RMF)How to build security into a system's lifecycle instead of bolting it on.

NIST Computer Security Resource CenterThe library everything above lives in.

CIS Critical Security ControlsIf NIST feels like too much, start here. Implementation Group 1 is a realistic first year for a small business.

FIPS Publications

Compliance

Compliance, by industry

This is general information, not legal advice. What actually applies to your business depends on your data, your contracts and your state. That's what an assessment is for.

Tools